Privacy Policy

1. Operators and controllers

shapeID is jointly operated by the following businesses (together, “shapeID”, “we”, or “us”). They are jointly responsible for the processing described in this policy unless a specific service identifies a different controller.

2. Data we process

Account and identity data

When you use Sign in with Apple, we receive an account identifier and, depending on your Apple settings, your name and email address or Apple relay email. We also process authentication sessions and security records needed to keep you signed in and protect your account.

Profile and fit data

You may provide your date of birth, gender, height, weight, clothing sizes, and permission preferences. We use this information to set up your profile, personalize fit-related features, and determine access to age-restricted or location-specific experiences.

3D scans and measurements

Scanner events may create and upload images, a 3D representation, previews, body measurements, scan timestamps, event details, and scanner or device metadata. These assets are associated with your account so you can view and use your scan. A local file you select with the app’s “View Custom Splat” feature is opened on your device and is not uploaded by that feature.

Location data

If you grant foreground location permission, the app may process precise or approximate location coordinates while you use it to show nearby deals, scanner events, and location-limited rewards. shapeID does not use this permission for continuous background location tracking.

Deals, rewards, and event activity

We process eligible deals, wheel results, claimed items, redemption status, event participation, and related timestamps so that rewards can be assigned, displayed, and redeemed.

Notifications and device data

If you enable notifications, we process your notification permission status, app installation identifier, push token, and delivery status. We may also process app version, operating system, request metadata, and limited diagnostic information for security, reliability, and troubleshooting.

Website data

When you visit shapeid.io, our hosting provider receives standard network request information. We use Umami for privacy-focused website analytics to understand aggregate traffic and page usage. The website does not use this analytics data for cross-site advertising.

3. Why we use data

• To create and secure your account and provide the app’s core features.
• To store, display, and manage your 3D scans and fit information.
• To show relevant deals, events, rewards, and redemption information.
• To send notifications you have chosen to receive.
• To provide support, prevent abuse, and improve service reliability.
• To meet legal, accounting, and regulatory obligations.

Depending on the situation, our legal bases under the GDPR are performance of a contract, your consent, compliance with legal obligations, and our legitimate interests in operating and protecting shapeID. You may withdraw consent at any time without affecting processing that occurred before the withdrawal.

4. Service providers and recipients

We disclose data only as needed to operate shapeID, including to:

• Apple for Sign in with Apple and platform services.
• Expo for push-notification delivery and related app infrastructure.
• Cloudflare and other contracted infrastructure providers for API delivery, hosting, security, database services, and object storage.
• Event or retail partners where necessary to provide a clearly identified event, deal, pickup, or redemption experience.
• Professional advisers, authorities, or other recipients where required by law or necessary to establish or defend legal claims.

Processors are required by contract to protect personal data and use it only for the agreed services. We do not sell personal data and do not use app data for third-party advertising tracking.

5. International transfers

We aim to process data in the European Economic Area. Some platform and infrastructure providers may process data in other countries. Where required, we rely on adequacy decisions, the European Commission’s standard contractual clauses, or another lawful transfer mechanism.

6. Retention and deletion

We keep account, profile, scan, and deal data while your account is active and for as long as needed to provide the relevant feature. Push tokens are kept until disabled, replaced, or removed. Security logs and support correspondence are retained for a limited period appropriate to their purpose. We may retain records longer where required by law, to resolve disputes, or to prevent fraud.

When an account-deletion request is completed, we delete or irreversibly anonymize associated personal data unless a legal retention duty applies. See Account deletion for the current request process.

7. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection to processing. You may withdraw consent and lodge a complaint with your local data-protection authority. You can revoke location, photo-library, biometric, and notification permissions in your device settings. Face ID or device biometric templates remain under the control of the operating system; shapeID receives only the authentication result.

To exercise a privacy right, contact either operator at hi@adlerlagune.com or c@luckenbach.io. We may need to verify your identity before completing a request.

8. Children

shapeID is not intended for children under 13. Users must have permission from a parent or legal guardian where required by local law. If you believe a child has provided data contrary to this rule, contact us so we can investigate and delete it where appropriate.

9. Security

We use technical and organizational safeguards designed to protect personal data, including access controls, transport encryption, restricted administrative access, and signed access to stored scan assets. No system can guarantee absolute security, so please contact us if you suspect unauthorized account activity.

10. Changes to this policy

We may update this policy as shapeID changes. We will publish the current version here and update the date above. We will provide additional notice when a change materially affects your rights or how we use personal data.